What does p=none mean? Why your DMARC may not be protecting you

You ran a DMARC check and it says your policy is p=none. You have DMARC, so you’re covered. Right? Not quite. p=none means someone can still send email that looks like it came from your agency, and it will still be delivered. It was designed as a first step, and more than a third of the UK agencies and practices we checked never took the second.

What does p=none mean?

p=none tells email providers to deliver messages that fail the DMARC check as normal, and to send you a report about them. It monitors. It does not protect.

A typical record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@youragency.co.uk

• v=DMARC1 says this is a DMARC record.
• p=none is the policy: take no action on failures.
• rua= is where the daily reports go. Without it, nobody receives them.

What happens when someone fakes your email on p=none?

A fraudster sends an email with your domain in the “from” line. The receiving mail server checks whether it came from a system you’ve approved (SPF) and whether it carries your digital signature (DKIM). It fails both.

The server then looks up your DMARC record for instructions. p=none gives none. So the message is judged on the provider’s own spam filters, like any other email. A well-written fake with no suspicious links can land in your client’s inbox.

You’ll find out the next day in a report, if a reporting address is set and someone reads it. By then the email has been read.

How many firms are stuck on p=none?

Monitor-only is the most common position in our October 2026 research. Of 896 UK agencies, PR firms and architecture practices, 321 (35.8%) were on p=none.

Sector	On p=none
PR and communications	39.4%
Creative and marketing agencies	37.1%
Architecture practices	30.4%

More than half of those 321 firms (172) had no reporting address. They are on a monitoring setting with nothing being monitored.

Why do firms stop at p=none?

Three reasons come up again and again.

• It meets the bulk-sender rules. Google, Yahoo and Microsoft require at least p=none from anyone sending more than 5,000 emails a day. If DMARC was added so newsletters stopped going to spam, p=none did that job.
• Fear of blocking real email. Agencies send from many systems: Microsoft 365 or Google, a CRM, a newsletter tool, accounts software, e-signature, website forms. Tighten the policy before each one is set up properly and its emails bounce. Parking the job feels safer.
• Nobody owns it. DMARC reports arrive as XML files that are hard to read without a tool. If nobody is named to read them, the setting stays where it was left.

How do you move from p=none to reject?

In stages, so nothing genuine gets blocked:

1. Make sure the reports reach someone. Add a reporting address, ideally one that feeds a tool which turns the XML into something readable.
2. List every system that sends email as you. The reports help here: they show every source using your domain.
3. Set each system up to pass. Each one needs to send through an approved server or sign its mail with your domain. Your IT provider or the system’s own setup guide covers this.
4. Move to p=quarantine. Failing mail now goes to spam. Watch the reports for anything genuine that’s caught.
5. Move to p=reject. Failing mail is now refused outright.

For a firm with a handful of sending systems, this can be done in a few weeks. The more systems you use, the longer step 3 takes.

What this means for your agency

If you’re on p=none, ask whoever looks after your IT two questions. Who receives our DMARC reports? When are we moving to quarantine? A named person and a date mean it’s in hand. No answer usually means it was set up and parked.

The checker at the top of this page shows whether your domain is on p=none, quarantine or reject. It takes about a minute.

Frequently asked questions

Is p=none better than no DMARC record? Yes. You get reports, and you meet the bulk-sender minimum. But it doesn’t stop fake email being delivered.

Is p=none required by Google? Google requires at least p=none from senders of more than 5,000 emails a day to Gmail. Yahoo and Microsoft set the same minimum.

Can p=reject block my real email? Yes, if a system that sends as you hasn’t been set up to pass. That’s why monitoring comes first.

How long should we stay on p=none? Long enough to find every system that sends email as you. For most firms that’s weeks, not years.

What’s the difference between quarantine and reject? Quarantine sends failing email to spam. Reject refuses it, so it never arrives.

Sources

• Cubit Technology: DMARC adoption in UK agencies, October 2026
• Google: Email sender guidelines
• Microsoft: Outlook’s new requirements for high-volume senders
• RFC 9989: the current DMARC standard